JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 20.81.159.0

20.81.159.0 was found in our database!

This IP was reported 24 times. Confidence of Abuse is 51%: ?

51%

ISP	Microsoft Corporation
Usage Type	Data Center/Web Hosting/Transit
ASN	AS8075
Domain Name	microsoft.com
Country	🇺🇸 United States of America
City	Boydton, Virginia

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 20.81.159.0

Whois 20.81.159.0

IP Abuse Reports for 20.81.159.0:

This IP address has been reported a total of 24 times from 22 distinct sources. 20.81.159.0 was first reported on December 26th 2025, and the most recent report was 1 week ago.

Old Reports: The most recent abuse report for this IP address is from 1 week ago . It is possible that this IP is no longer involved in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
Anonymous	2026-06-04 06:47:50 (1 week ago)	Blocked by UFW (TCP on 7848) Source port: 56329 TTL: 228 Packet length: 40 TOS: 0x14 This report (f ... show more Blocked by UFW (TCP on 7848) Source port: 56329 TTL: 228 Packet length: 40 TOS: 0x14 This report (for 20.81.159.0) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter show less	Port Scan
Anonymous	2026-06-03 06:41:04 (2 weeks ago)	Bot / scanning and/or hacking attempts: GET /config/database.yml HTTP/1.1, GET /.env.local HTTP/1.1, ... show more Bot / scanning and/or hacking attempts: GET /config/database.yml HTTP/1.1, GET /.env.local HTTP/1.1, GET /.env.backup HTTP/1.1, GET /wp-config.php HTTP/1.1, GET /app/config/parameters.yml HTTP/1.1, GET /phpinfo.php HTTP/1.1, GET /.git/config HTTP/1.1, GET /.env HTTP/1.1, GET /backup.sql HTTP/1.1, GET /dump.sql HTTP/1.1 show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-06-03 06:22:26 (2 weeks ago)	(mod_security) mod_security (id:210492) triggered by 20.81.159.0 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210492) triggered by 20.81.159.0 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 02:22:18.785145 2026] [security2:error] [pid 20770:tid 20770] [client 20.81.159.0:21343] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.150"] [uri "/.git/HEAD"] [unique_id "ah_IGqBq8_Kjt8-l-zK8UQAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇫🇷 dynamix	2026-06-03 06:06:25 (2 weeks ago)	Multiple WAF Violations	Web App Attack
🇩🇪 MBombeck	2026-06-03 05:10:07 (2 weeks ago)	Fail2Ban/traefik-botsearch on ops-01.bombeck.io: banned after 5 failures	Web App Attack
🇺🇸 MPL	2026-06-03 04:58:11 (2 weeks ago)	tcp port scan (8 or more attempts)	Port Scan
🇬🇧 PeravixGroup	2026-06-03 04:28:29 (2 weeks ago)	Honeypot detection: Web application scanning / reconnaissance attempt on port 8080. Severity: LOW. A ... show more Honeypot detection: Web application scanning / reconnaissance attempt on port 8080. Severity: LOW. Aaran.cloud show less	Port Scan Bad Web Bot
🇨🇦 polycoda	2026-05-26 10:37:24 (3 weeks ago)	📡 Port scan	Hacking Web App Attack
🇨🇦 DRI	2026-05-26 05:26:56 (3 weeks ago)	Unsolicited TCP traffic on Honeypot, srcport=5120 dstport=8848	Port Scan Hacking
Anonymous	2026-05-25 13:05:33 (3 weeks ago)	Blocked: Reason='Suspicious traffic score=80 (review-based detection)'; Requests=31	Hacking
🇺🇸 TPI-Abuse	2026-05-25 11:43:26 (3 weeks ago)	(mod_security) mod_security (id:210492) triggered by 20.81.159.0 (-): 1 in the last 300 secs; Ports: ... show more (mod_security) mod_security (id:210492) triggered by 20.81.159.0 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 07:43:18.880468 2026] [security2:error] [pid 3744:tid 3744] [client 20.81.159.0:7168] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pappakotis.com"] [uri "/config/.env"] [unique_id "ahQ11lqdaIYjagdJpvRhlwAAAAY"], referer: https://www.notion.so/ show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 big-cloud.nl	2026-05-25 10:12:45 (3 weeks ago)	Try to access /config/.env	Web App Attack
Anonymous	2026-05-17 19:15:24 (4 weeks ago)	Unauthorized connection attempt	Port Scan Hacking Exploited Host
Anonymous	2026-04-03 06:54:37 (2 months ago)	Aggressive web scan	Web App Attack
🇬🇧 2048	2026-03-15 13:07:03 (3 months ago)	2026-03-15T14:06:59.645845+01:00 machodeer kernel: [1836838.301840] [UFW BLOCK] IN=ens3 OUT= MAC=RED ... show more 2026-03-15T14:06:59.645845+01:00 machodeer kernel: [1836838.301840] [UFW BLOCK] IN=ens3 OUT= MAC=REDACTED SRC=20.81.159.0 DST=REDACTED LEN=60 TOS=0x00 PREC=0x00 TTL=44 ID=26122 DF PROTO=TCP SPT=13122 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 2026-03-15T14:07:00.672910+01:00 machodeer kernel: [1836839.328543] [UFW BLOCK] IN=ens3 OUT= MAC=REDACTED SRC=20.81.159.0 DST=REDACTED LEN=60 TOS=0x00 PREC=0x00 TTL=44 ID=26123 DF PROTO=TCP SPT=13122 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 2026-03-15T14:07:01.697139+01:00 machodeer kernel: [1836840.352738] [UFW BLOCK] IN=ens3 OUT= MAC=REDACTED SRC=20.81.159.0 DST=REDACTED LEN=60 TOS=0x00 PREC=0x00 TTL=44 ID=26124 DF PROTO=TCP SPT=13122 DPT=443 WINDOW=64240 RES=0x00 SYN URGP=0 show less	Port Scan

Showing 1 to 15 of 24 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 200.196.40.133

🇧🇷 152.241.68.79

🇺🇸 147.182.129.34

🇮🇩 140.0.235.150

🇨🇳 118.196.56.74

🇺🇸 52.42.222.125

🇫🇷 46.105.218.128

🇺🇸 34.19.127.208

🇨🇦 20.104.244.165

🇨🇳 218.78.60.105

🇺🇸 205.186.137.75

🇧🇩 203.18.158.156

🇩🇪 195.230.103.244

🇬🇧 185.216.145.190

🇨🇳 120.77.144.101

🇷🇴 94.156.152.50

🇺🇸 64.62.156.52

🇩🇪 45.150.174.97

🇳🇱 45.142.193.8

🇺🇸 44.228.150.189